Federal Agencies Report Rise in Cyber Threats
Defense companies see increased infiltrations as officials combat schemes involving illicit overseas IT workers.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust that private companies are doing enough to verify the identity of job applicants?
Federal agencies report a surge in foreign infiltration attempts and insider cyber threats against U.S. defense firms. The Justice Department has also moved to dismantle a long-running scheme that placed North Korean IT workers in over 70 American companies.
Why it matters
Foreign entities are actively targeting American technology and research to compromise national defense capabilities. These breaches cost companies millions annually and threaten the integrity of sensitive domestic information.
Defense companies reported over 22,000 suspicious contacts in fiscal year 2025, while 2,900 incidents involved foreign actors actively seeking sensitive research. Credential theft remains a major technical burden, costing individual companies approximately $4.8 million annually.
The players
Department of Justice
The federal executive department responsible for the enforcement of federal laws and the administration of justice in the United States.
The details
North Korean IT workers utilized remote desktop software to access employment devices, generating an estimated $3 million in illicit revenue. Meanwhile, the Justice Department seized 187 computer devices used in the scheme and continues to investigate foreign entities using resume submittals to exploit subject matter experts.
Timeline
2019–2025: Duration of the North Korean IT worker scheme.
2023: Companies reported 28,000 suspicious contacts.
2024: Companies reported approximately 32,000 suspicious contacts.
Fiscal year 2025: Reporting period for recent threat and contact data.
The Tech Race
These cyber threats mark a significant shift as foreign entities move beyond external hacking to active internal infiltration. This evolution forces defense firms to abandon legacy security perimeters in favor of more robust, identity-verified remote access protocols.
For employees in the defense and technology sectors, these threats necessitate stricter multi-factor authentication requirements and limited access to remote desktop tools. These security measures may increase daily login times and require more rigorous vetting for contractors.
The takeaway
Companies should implement aggressive zero-trust architecture to detect unauthorized access early, as containment currently takes an average of 81 days. Organizations must also standardize thorough background checks for all remote IT personnel to mitigate the risk of state-sponsored infiltration.
Further reading
Learn more about evolving digital defenses on the Cybersecurity page.
Source note: This article includes information reported by Federal News Network.
Live Poll
Do you trust that private companies are doing enough to verify the identity of job applicants?
